Performance of various quantum key distribution systems using 1.55 /im 
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We compare the performance of various quantum key distribution (QKD) systems using a novel 
single-photon detector, which combines frequency up-conversion in a periodically poled lithium nio- 
bate (PPLN) waveguide and a silicon avalanche photodiode (APD). The comparison is based on the 
secure communication rate as a function of distance for three QKD protocols: the Bennett-Brassard 
1984 (BB84), the Bennett, Brassard, and Mermin 1992 (BBM92), and the coherent differential 
phase shift keying (DPSK) . We show that the up-conversion detector allows for higher communica- 
tion rates and longer communication distances than the commonly used InGaAs/lnP APD for all 
the three QKD protocols. 

PACS numbers: 03.67.Dd; 42.65.-k 

I. INTRODUCTION II. 1.55 fim SINGLE-PHOTON DETECTORS 
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Quantum key distribution (QKD) allows two parties 
to share an unconditionally secure secret key. Security 
is guaranteed by the laws of quantum mechanics, ensur- 
ing that the key can be used afterwards to encrypt and 
decrypt secret messages as a one-time pad. The most 
common QKD protocols, which have been implemented 
in experiments over the last years Q , are the BB84 pro- 
tocol, which uses single photons as information carriers 
0, and the entanglement-based BBM92 protocol 0. A 
security analysis for these protocols under realistic sys- 
tem parameters and against individual attacks has been 
performed 0, ||- This analysis shows that the perfor- 
mance of a quantum cryptography system, in terms of 
communication distance and secure communication rate, 
is determined by the characteristics of the source of single 
or entangled photons, and of the single-photon detectors. 
In addition to the BB84 and BBM92 protocols, we con- 
sider the recently proposed differential phase shift keying 
(DPSK) protocol, which uses a weak coherent pulse train 
as the information carrier 0,0 ■ To this end, we develop a 
security analysis against certain types of hybrid attacks. 

To date, fiber-optic QKD systems have invariably used 
InGaAs/lnP avalanche photodiodes (APDs) as single- 
photon detectors. Recently, an alternative technology for 
very efficient single-photon detection at 1.55 /im, based 
on the principle of frequency up-conversion, was pre- 
sented |8j. Using realistic experimental parameters, we 
perform comparisons for the various types of sources and 
protocols, and show that longer communication distances 
and higher communication rates can be achieved using 
the up-conversion detector in all cases. 
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A. InGaAs/lnP avalanche photodiode 



The InGaAs/lnP avalanche photodiodes have been the 
subject of thorough investigation over the last decade 
due to their importance as single-photon detectors in 
fiber-optic QKD implementations. Although consider- 
able progress has been achieved in the performance of 
these detectors [3, Gil liil HH LUI , they exhibit low quan- 
tum efficiencies (typically on the order of 0.1), and, most 
seriously, they suffer from after-pulse effects caused by 
trapped charge carriers, which produce large dark count 
rates during a relatively long time. The high dark count 
probability imposes gated-mode operation, which limits 
their capabilities significantly. In particular, when op- 
erated in gated mode, the APD device is raised above 
breakdown threshold for a few nsec, which ensures low 
probability of a dark count and high efficiency for de- 
tecting light. Subsequently, the device is returned to be- 
low breakdown for a time long enough for any trapped 
charge carrier to leak away. Given that the trapping 
lifetime is on the order of a /zsec, this mode allows oper- 
ation at MHz rates, while the after-pulse probability is 
reduced by the ratio of the gate width to the time separa- 
tion between gates. In a QKD application, this gate fre- 
quency determines the repetition rate of the signal pulse 
and, therefore, limits the attainable communication rate. 
Furthermore, the dark count rate, which is critical for 
the communication distance, is determined by the gate 
width, limited by the response time of the semiconductor 
material. Typically, gate widths of 1 — 2 nsec at ~ 1 MHz 
repetition frequency are used with resulting dark count 
rates on the order of 10 4 /sec. 
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FIG. 1: Quantum efficiency of the 1.55 /im up-conversion 
single photon detector as a function of pump power. The 
expression for the fitting curve is given by Eq. Q. 
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FIG. 2: Dark count rate of the 1.55 /im up-conversion single 
photon detector as a function of pump power. The expression 
for the fitting curve is given by Eq. (0. 



B. Up-conversion detector 

In the 1.55 /mi up-conversion single-photon detector 
, a single photon at 1.55 fjxa interacts with a strong 
pump at 1.32 /im in a periodically poled lithium niobate 
(PPLN) waveguide, designed for sum-frequency genera- 
tion at these wavelengths 0|. Due to the quasi-phase- 
matching and the tight mode confinement over long in- 
teraction lengths achieved in a guided-wave structure, 
this device allows for very high conversion efficiency of 
the signal to the ~ 0.7 /im sum frequency output. The 
converted photon is subsequently detected by a silicon 
APD. Contrary to InGaAs/InP APDs, Si APDs have 
high quantum efficiencies in the near-infrared (typically 
on the order of 0.6 — 0.7), very low dark count rates, 
and very small after-pulse effects. The last character- 
istic enables Geiger (non- gated) mode operation of the 
Si APD, which does not impose any severe limitation to 
the attainable communication rate in a QKD system. In 
practice, however, the rate is limited by the dead time of 
Si APD detectors, which is on the order of 50 nsec for 
commercial devices. During this time period that follows 
a photo-detection event, the photodiode cannot respond 
to subsequent events, and, eventually, a very large pho- 
ton flux saturates the device. This effect is taken into 
account in the calculations of Section HVI 

The main characteristics of the up-conversion detec- 
tor, such as the quantum efficiency, r/ up , and the dark 
count rate, D up , depend on the pump power, p Q. When 
the phase-matching condition in the waveguide is met 
and sufficient pump power is available to achieve almost 
100% photon conversion, a maximum overall quantum 
efficiency of 0.46 is achieved, as shown in Fig.^ In agree- 
ment with the coupled mode theory for three- wave inter- 
actions in a waveguide, which predicts a sin 2 dependence 
of ?7up on p, the fitting curve of the experimental results 



is given by the following expression: 

Vupip) = 0,1 sin 2 (^/a^p) (1) 

where ai = 0.465, a 2 — 79.75, and p is given in mW. 

On the other hand, the dark count rate is domi- 
nated by a combined nonlinear process: Initially, the 
pump photons are scattered by the phonons of both 
the PPLN waveguide and the fiber via a spontaneous 
Raman scattering process. This process scales linearly 
with the pump power, and generates a spectrum of 
Stokes photons, which includes the signal wavelength 
of 1.55 /im. Subsequently, the noise photons interact 
with the pump photons in the waveguide via the phase- 
matched sum-frequency generation process, and create 
dark counts. The combined process results in an approx- 
imately quadratic dependence of the dark counts on the 
pump power, as shown in Fig. [5] A more accurate poly- 
nomial fitting curve is given by the following expression: 

D up {p) = b + bip + b 2 p 2 + b 3 p 3 + b 4 p 4 (/sec) (2) 

where b = 50, b x = 826.4, b 2 = 110.3, b 3 = -0.403, 
64 = 0.00065, and p is again given in mW. 

An important feature of the up-conversion detector 
stems from the fact that the dark counts depend on 
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FIG. 3: Ideal communication system employing an up- 
conversion detector. 
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FIG. 4: Dark counts per time window/gate for the up- 
conversion single-photon detector operating at the minimum 
NEP regime, and a typical InGaAs/lnP APD respectively, in 
the communication system described in Fig. |3] 



III. COMMUNICATION RATE EQUATIONS 

In this paper, we will consider only individual attacks, 
that is Eve is restricted to attack only individual bits; 
she is not allowed to perform a coherent attack consist- 
ing of collective quantum operations and measurements 
of many qubits with quantum computers. In a QKD sys- 
tem, the raw transmission of random bits is followed by 
a public exchange of information on the time of single- 
photon detection and the bases used by the two parties, 
which results in the sifted key. The steps of classical 
error-correction and privacy amplification follow. The 
first step serves the dual purpose of correcting all erro- 
neously received bits and giving an estimate of the er- 
ror rate. Privacy amplification is then used to distill a 
shorter key, the final key, which can be made as secure as 
desired. The security analyses of 0,0 take all the above 
steps into account and derive the communication rate 
equations that are re-stated in Sections IIII Al and IIII Bl 
In Section IIII CI we derive the corresponding equation 
for the DPSK protocol, based on the security analysis 
against certain types of hybrid attacks. 



the bandwidth of the waveguide, as this determines the 
number of noise photons. We can define a quantity, 
-Dup-Hz = -jp (scc _1 Hz _1 ), for a detector with band- 
width Bd, which corresponds to the dark counts per 
mode. Then, we can think of the ideal communication 
system shown in Fig. [3] with a matched filter with band- 
width equal to the bit rate B. In such a system, the dark 
counts per time window, d up , a parameter of great im- 
portance in QKD applications, is equal to -D up _Hz- Note 
that d up is independent of the bit rate B (or measurement 
time window l/B) under this optimum filtering. An In- 
GaAs/InP APD operated in gated mode has dark counts 
per gate, c?apd, calculated by Dapd-^, where -Dapd 
(/sec) is the dark count rate of the InGaAs/lnP APD. In 
Fig. 0] the quantity d is plotted for the two types of de- 
tectors as a function of the bit rate. For the InGaAs/lnP 
APD, the typical value Z?apd — 10 4 /sec is used. For the 
up-conversion detector, we calculate the quantity D U p-Hz 
at the operating point of the detector, where the nor- 
malized Noise Equivalent Power (NEP), ^/2D/rj, is mini- 
mized, which corresponds to D up — 6.4 x 10 3 /sec and 
Vnp = 0.075. Given a bandwidth of B^ = 50 GHz 
for the up-converter, we find that the optimum d np is 
~ 1.3 x 10~ 7 , as shown in Fig.^J This result illustrates 
the significant advantage of the up-conversion detector 
for most practical system bit rates. 

The dependence of the dark counts on the waveguide 
bandwidth, together with the non-gated mode operation 
of the Si APD and the pump power dependence of the 
detector characteristics, have a significant effect on the 
performance of a quantum cryptography system employ- 
ing up-conversion detectors, as we will see in the following 
sections. 



A. BB84 protocol 

In the BB84 protocol, Alice sends Bob single photons 
randomly modulated in two non-orthogonal bases. Bob 
measures the polarization states of the single photons in 
a randomly chosen polarization basis. The secure com- 
munication rate of this protocol against an arbitrary in- 
dividual attack, including the most commonly considered 
intercept-resend and photon-number splitting (PNS) at- 
tacks Q|, is given by the following expression: 

-Rbb84 = ^PciickiXe, /?) + /(e)[elog 2 e + 

(l-e)log 2 (l-e)]} (3) 

In the above equation, the factor \ is called the sifting 
parameter and is due to the fact that half of the times 
Alice's and Bob's polarization bases are not the same. 
The repetition rate of the transmission is given by v. 
The probability that Bob detects a photon is 

Pclick = Psignal + Pdark (4) 

Simultaneous signal and dark counts are ignored in the 
above expression, and the two components are given by 

Signal - W 10- (Qi+Ll)/1 ° (5) 
Pdark = id (6) 

where [i is the average number of photons per pulse, r\ the 
quantum efficiency of the detector, a the loss coefficient 
of the optical fiber in dB/km, L the distance in km, L x 
the loss of the receiver unit in dB, and d the dark counts 
per measurement time window of the system. The coef- 
ficient 4 in Eq. © is due to the assumption of a passive 
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TABLE I: Benchmark performance of the error-correction al- 
gorithm given in [lEll . 
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detection unit involving four detectors at Bob's site, as 
in For an ideal single-photon source, fj, = 1, while 
for a Poisson source, which corresponds to the common 
weak laser pulse implementations 0, \x becomes a free 
variable which should be optimized. 

The error rate is given by the expression: 



2 /Mark ~t~ ^Psignal 
Pclick 



(7) 



where b is the baseline system error rate, which cannot be 
distinguished from tampering. The last term in Eq. @ 
corresponds to the additional shrinking of the sifted key 
due to the leakage of information to Eve during classical 
error correction. The function /(e) depends on the error- 
correction algorithm and its values are given in Table ^ 
for the bi-directional algorithm developed in |15| . 

Finally, the main shrinking factor r(e, (3) in the privacy 
amplification step is related through the expression 



log 2 Pc 



to the average collision probability, p c . This is a measure 
of Eve's mutual information with Alice and Bob. In Q 
the following result is derived for r: 



r(e, /?) = -/? log 



1 „ e „ I e 
- + 2 2 

2 (3 



(9) 



The parameter f3 is defined as the fraction of single- 
photon states emitted by the source: 







i^click Pm 
Pclick 



(10) 



where p m is the probability that the source emits a multi- 
photon state. For an ideal single-photon source, p m = 
(i.e., j3 = 1), while for a Poisson source, 



Pm = 1 - (1 + p)e~ 



(11) 



Essentially, the parameter f3 accounts for the PNS at- 
tacks, with which Eve can obtain full information with- 
out causing any error in the communication between Al- 
ice and Bob by performing a quantum non-demolition 
(QND) measurement of the photon number in each pulse, 
keeping one photon in her quantum memory when she 
detects multiple photons, and applying a delayed mea- 
surement on her photon after the public announcement 



of the bases by Bob. This attack is a major restricting 
factor in the performance of a weak laser pulse imple- 
mentation of the BB84 protocol. The secure communica- 
tion rate decreases quadratically with the transmission of 
the quantum channel, 1CP qL / 10 , for small error rate and 
Pdark "C Psignai *C 1- On the contrary, for an ideal single- 
photon source implementation, under the same condi- 
tions we find i?BB84 ~ ^Psignai, i-e., the rate decreases 
only linearly with the fiber transmission. 

The above security analysis is based on the assump- 
tion that Eve has a quantum memory with an infinitely 
long coherence time because Alice and Bob can delay the 
public announcement for an arbitrarily long time. If Eve 
is not equipped with such a quantum memory, she must 
perform the polarization measurement with a randomly 
chosen basis. In this realistic case, Eq. (0 must be mod- 
ified to: 



1 + /3 



log 2 



"1 + /3 



1 + P 



(12) 



B. BBM92 protocol 



The BBM92 protocol is the two-photon variant of 
BB84. Alice and Bob each share a photon of an en- 
tangled photon-pair, for which they measure the polar- 
ization state in a randomly-chosen basis out of two non- 
orthogonal bases. It was shown in |5j that the average 
collision probability, p Cl for this protocol is the same as 
that of the BB84 with a single-photon source, i.e., with 
(3 = 1. The shrinking factor r becomes: 



r(e) 



log 2 



1 

2 +2e " 



2e z 



(13) 



This indicates that there is no analog to a photon-number 
splitting attack in BBM92. In general, the nature of 
this entanglement-based protocol renders it more robust 
than BB84; for example it is less vulnerable to errors 
caused by dark counts, since one dark count alone cannot 
produce an error in this protocol. The equation for the 
secure communication rate against any individual attack 
is given by the following expression 



1 



-Rbbm92 = x ^Pcoin{i~(e) + /(e) [e log 2 e + 
(l-e)log 2 (l-e)]} 



(14) 



The sifting parameter is the same as in BB84, while the 
probability of a coincidence between Alice and Bob is 



Pc 



Ptr 



Pfalsc 



(15) 



The expressions for the probability of a true coincidence, 
Ptruo, and the probability of a false coincidence, Pf a isc, are 
different for a deterministic entangled-photon source and 
a Poissonian entangled-photon source, such as a paramet- 
ric down converter (PDC). They are given below, under 
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the assumption that the source is placed halfway between 
the two parties |5|- 



1. Deterministic entangled-photon source 

Ptrue = , ? 2 l(n^+ 2i -)/ 10 



Pfalsc 



= 8^kH qL+2L '>/ 20 + 16d 2 



2. Poissonian entangled-photon source 

Ptrue = C\ 

Pfalsc = 16d 2 c 2 + 8dc 3 + c 4 

where 
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and 



t L = vl 0-(^+2L r )/20 



(16) 
(17) 



(18) 
(19) 



(20) 
(21) 

(22) 

(23) 

(24) 



All the parameters in the above equations are defined 
as in the previous section. The parameter x> which 
appears in the case of the Poissonian entangled-photon 
source, is a free variable that depends on the average 
photon-pair number per pulse, i.e. the nonlinear coeffi- 
cient, the pump energy and the interaction time of the 
down conversion process. Finally, the error rate is given 
by the expression: 



bpt 



Pc 



(25) 



For small error rate and pf a i sc <C ptruc, the secure com- 
munication rate of BBM92 decreases linearly with the 
transmission of the quantum channel, similarly to the 
case of the BB84 protocol with a single photon source. 
Note that Eve does not need a quantum memory to at- 
tack the BBM92 protocol. Equation l|14|l is solely deter- 
mined by the intercept and resend attack. 
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FIG. 5: Configuration of the DPSK protocol. PM: phase 
modulator, ATT: attenuator, BS: beam-splitter, DET: detec- 
tor. 



with random {0, 7r} phase modulation are mutually non- 
orthogonal. The idea of encoding the information in the 
phase of highly attenuated coherent pulses was first pre- 
sented by Bennett in 1992 [lfj. The DPSK protocol is 
a simpler but more efficient protocol compared to the 
B92 protocol. A similar protocol has also recently been 
proposed [T7| . 

In the DPSK protocol, shown in Fig. [5J all pulses 
are highly attenuated and randomly phase-modulated by 
{0, 7r}. Each photon coherently spreads over many pulses 
with a fixed phase modulation pattern. In the receiver 
side, Bob randomly modulates the delay time N x r in 
his interferometer by randomly choosing a positive inte- 
ger N, as shown in Fig. [31 where r is the inverse of the 
clock frequency. After passing through Bob's interferom- 
eter, the pulses interfere at Bob's output beam-splitter, 
and which detector clicks depends on the phase differ- 
ence of the two pulses separated by a time Nxt. Bob 
announces publicly the time instances at which a photon 
was detected and the randomly chosen positive integer 
N. From her modulation data Alice knows which de- 
tector recorded the event. Thus, they form a secret key 
by assigning a bit value to each detector. The shifting 
parameter is 1 since all bits are utilized during the key 
formation. 

The security of the DPSK protocol stems from the fact 
that the information is encoded on the differential phase 
of two nonlocal pulses. This renders the protocol robust 
against any type of individual photon splitting attack 
|l8l Il9| . In order to derive the communication rate 
equation, we need to calculate the privacy amplification 
shrinking factor, r, defined in Eq. (JSJ as a function of 
the average collision probability, p c . Our analysis takes 
into account a hybrid attack, which consists of two types 
of collective attacks: 

1. Beam-splitter attack 



C. DPSK protocol 

Instead of using two non-orthogonal bases as in BB84 
and BBM92, the differential phase shift keying (DPSK) 
protocol uses many non-orthogonal states consisting of 
many pulses 0, ■ I n particular, it is based on the fact 
that highly attenuated coherent states of many pulses 



Eve uses a beam-splitter with transmission ?7bs to ob- 
tain coherent copies of the quantum state of many pulses 
that Alice sends to Bob. She also replaces the lossy opti- 
cal fiber with a loss-less one, and the inefficient detectors 
at Bob's receiver unit with ideal ones. Without Eve's 
intervention, Bob's probability of detecting a signal pho- 
ton, p s ig na i, is identical to the one given in Eq. JSJ). In 
order to leave this probability unaltered, Eve has to set 



6 



the beam-splitter transmission, 773s i to: 

Vbs = v lQ-( aL + L ^/ 10 (26) 

where all the parameters are defined as in Section IlII Al 
One possibility for Eve is to measure the pulses that she 
picks up with an interferometer with delay time M X r 
chosen independently from Bob's. In this case, her in- 
formation gain is calculated as follows: the probabil- 
ity of a detection event at Eve's and Bob's site at a 
given time slot is given by fx(l — t?bs) and yuryes respec- 
tively, where /i is the average number of photons per 
pulse. Thus, the probability of a detection event at the 
same time instance is equal to /i 2 ?7Bs(l ~ ?7bs)- O n the 
other hand, the probability that Eve's randomly chosen 
M matches Bob's N is equal to 1/N. Then, the prob- 
ability that Eve gains bit information relative to Bob 
is m 2? 7bs(1 - t?bs)/(a"7bs^) = M 1 ~ ms)/N. This is 
true if we assume that Eve is not equipped with a quan- 
tum memory with an infinitely long coherence time or 
if Alice and Bob encrypt their public channel commu- 
nication. However, if we allow Eve to have a quantum 
memory and the two parties do not encrypt their public 
exchange of information, Eve's strategy can be changed 
in order to increase her information gain. In this case, 
she keeps the pulses in her quantum memory and waits 
for Bob's announcement. Note that Alice and Bob can 
delay the public announcement for an arbitrarily long 
time, so Eve's quantum memory must have an infinitely 
long coherence time. Then, Eve uses an optical interfer- 
ometer with an active switch that allows her to interfere 
only the pulses for which she is aware that Bob has ob- 
tained the differential phase information. This strategy 
increases Eve's probability of gaining bit information to 
2jLt(l — ?7bs)- The beam-splitter attack does not cause 
any error in the communication between Alice and Bob, 
hence it gives full information, i.e., p c = 1, to Eve for 
a fraction of bits equal to /x(l — ?7bs)/^ or 2/i(l — ?7bs)- 
The remaining fraction of the bits is given by: 



jj(i-'?Bs) _ 1 _ r_ 

N ~ 1 N ~<~ N 

:without quantum memory 
• 2/i(l - ?7bs) = 1 - 2/x + 2p signa i 
:with quantum memory 



(27) 



2. Intercept-resend attack 

Eve also applies an intercept and resend attack to 
some of the pulses that are sent to Bob after her beam 
splitter. In particular, Eve intercepts two pulses with 
a time interval M x t, lets them pass through an 
interferometer with an identical delay M x r, measures 
the differential phase, and according to her measurement 
result she sends an appropriate state to Bob. We assume 
that in the case of an inconclusive or vacuum outcome 
she sends the vacuum state, while when she measures a 
single photon she sends a photon split into two pulses 
with the correct phase difference applied between them. 
In this case, when Bob picks up an identical delay, 



N = M, and measures the central time slot, he does not 
detect the eavesdropping because he obtains the correct 
answer. However, with probability 1 — -J^ he chooses 
another delay, N ^ M, or measures the side time slots, 
which yield random, uncorrelated results, and with 
probability \ these lead in error. Hence, this attack 
causes a bit error of \ (l — in the communication 
between Alice and Bob. If the error rate of the system is 
e, Eve is allowed to apply her attack to a fraction y^TJw 
of the pulse-pairs in order not to exceed this error rate. 
With probability J^, she obtains full information for 
these intercepted pulse-pairs. 

In summary, taking into account the hybrid attack 
consisting of the beam-splitter and intercept-resend at- 
tacks, we find that the fraction of bits for which Eve 
has no information, i.e., for which p c = h, is equal to 
7 — iV(i-i/2iV) • Thus, we have calculated the privacy 
amplification shrinking factor, 



r(e,7) = 7- 



N(l 



2N t 



(28) 



where 7 is given by Eq. I[27JI, We can now write the 
equation for the secure communication rate of the DPSK 
protocol against the hybrid attack we considered: 



-Rdpsk = ^Pciick{T(e,7) + /(e)[elog 2 e + 
(l-e)log 2 (l-e)]} 



(29) 



In the above equation, v is the repetition rate of the 
transmission. The probability that Bob detects a photon, 
Pciick, is defined in Eq. The probability of a signal 
count, ^signal, is given by Eq. (J5J, while the probability of 
a dark count, Pdark, in this case is given by the expression: 



Pdark = 2d 



(30) 



because there are two detectors at the receiver unit. Fi- 
nally, the error rate is defined in Eq. (J7J, and the values 
of /(e) are given in TablcQ] 

In the case of small error rate and pdark <C Psignai <C 1, 
Eq. (|2*^|) gives -Rdpsk ~ v(l — ^)p s i g nai without a quan- 
tum memory, or -Rdpsk ~ v(l — 2/x)p s i gna i with a quan- 
tum memory. This means that the secure rate for the 
DPSK protocol decreases linearly with the fiber trans- 
mission. This is in agreement with the results of [l7| and 
[20|. who have considered a protocol similar to DPSK 
and a slightly modified B92 protocol respectively. 



IV. NUMERICAL RESULTS 

We compare the performance of quantum key distribu- 
tion systems implementing the BB84, BBM92 and DPSK 
protocols, when the up-conversion single-photon detec- 
tor is used. In order to do that, we calculate the secure 
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communication rate as a function of distance for fiber- 
optic implementations of the three protocols, based on 
Eqs. ©,1111) and (j2Hl respectively. In the case of BB84 
and BBM92, both ideal and realistic sources of single and 
entangled photons are considered. Some parameters are 
fixed in all simulations: the channel loss is set to a = 0.2 
dB/km at 1.55 /zm, the baseline system error rate is set 
to b = 0.01, and in addition to the fiber losses we assume 
an extra loss of L r = 1 dB at the receiver site. As men- 
tioned in Section fill Al in the case of a weak laser pulse 
implementation of the BB84 protocol, the average num- 
ber of photons per pulse, /i, is an adjustable parameter, 
with respect to which the rate is numerically optimized at 
each distance. Intuitively, such optimization is necessary 
because when this parameter is too low the dark counts 
dominate, while when it is too high the probability of 
multi-photon pulses becomes very large. In both cases, 
secure communication quickly becomes impossible. The 
corresponding adjustable parameter is x m the case of 
the BBM92 protocol with a Poissonian entangled-photon 
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FIG. 6: Secure communication rate as a function of distance 
for the BB84 protocol employing a Poisson or an ideal single- 
photon source. 



It is clear from the analysis of Section IIIII that the 
critical parameters for the performance of a quantum 
cryptography system related to the single-photon detec- 
tor employed are the dark counts per measurement time 
window, d, the quantum efficiency, 77, and the repetition 
rate of the transmission that it allows, v. In the case 
of the up-conversion single-photon detector, due to the 
non-gated mode operation of the Si APD there is no se- 
vere limitation to the repetition rate of the experiment. 
In practice, the limit is set by the speed of the electronic 
equipment as well as by the timing jitter of the Si APD 
(typically 0.5 — 0.7 nsec). A realistic value, compatible 
with currently available components, is = 1 GHz. As 
was explained in Section III Bl the limiting factor for the 
attainable communication rate is the dead time of the 
Si APD, id- Assuming that the photo-detection events 
follow a Poisson process, the probability of two events oc- 
curring in a time period larger than td is given by the ex- 
ponential factor e-^Pciick'^ where $ depends on the num- 
ber of detectors in the receiver unit. For the typical value 
td = 50 nsec, this saturation factor becomes rather small 
at rates greater than a few MHz, limiting the final rate at 
small fiber losses. Using Eqs. Q and (|2Jl, we numerically 
optimize the communication rate for each protocol with 
respect to the pump power, p, at each distance. Such 
optimization is intuitively necessary because depending 
on the communication distance an equilibrium between 
the values of the quantum efficiency and the dark counts 
of the up-conversion detector has to be established. The 
result of this optimization indicates the optimal regime 
of operation of the detector at each distance. Finally, 
the optimum filtering configuration, shown in Fig. |3J is 
assumed, which sets the measurement time window to 1 
nsec. 

The simulation results are shown in Figs. El \7\ and |S] 

for the BB84, BBM92, and DPSK protocols respectively. 
Each curve features a cut-off distance, which is due to 
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FIG. 7: Secure communication rate as a function of distance 
for the BBM92 protocol employing a Poissonian or a deter- 
ministic entangled-photon source. 



the increasing contribution of the dark counts with fiber 
length. The saturation effect, related to the dead time of 
the Si APD, is apparent for small fiber losses and high 
bit rates. 

In the case of BB84 with a Poisson single-photon 
source, we observe in Fig. that not allowing Eve to 
possess a quantum memory with an infinitely long co- 
herence time does not have a major effect on the per- 
formance of the system. The quadratic decrease of the 
rate of the communication rate with the fiber length, a 
consequence of the PNS attacks, is a dominant factor, 
making this implementation unsuitable for long-distance 
quantum cryptography. On the contrary, the use of an 
ideal single-photon source allows for a significantly longer 
communication distance with high communication rates. 
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FIG. 8: Secure communication rate as a function of distance 
for the DPSK protocol employing time delay parameters N 
= 1, 10, or 100. 



However, such a source does not exist today at 1.55 /xm, 
although efforts towards this goal are underway plf. 

As shown in Fig. \7\ the inherently more robust 
entanglement-based BBM92 protocol allows for even 
longer communication distances, having the capability 
to achieve a practical 1 Hz secure key generation rate at 
more than 300 km with a deterministic entangled-photon 
source. However, technological difficulties related to en- 
tanglement generation and coincidence detection at 1.55 
yitm have limited until today this distance to 30 km |22^ . 

The DPSK protocol features characteristics very sim- 
ilar to BB84 with a single-photon source, due to its ro- 
bustness to PNS attacks, as was shown in the security 
analysis of Section IIII CI In this case, when a realistic 
scenario is assumed, where Eve does not possess a quan- 
tum memory with an infinitely long coherence time, or 
Alice and Bob encrypt their public communication, we 
observe in Fig. 0a significant effect on the performance of 
the system. Indeed, introducing a time delay parameter 
N greater than 1 enhances both the secure communica- 
tion rate and the communication distance of the system 
considerably. Nevertheless, the advantage becomes com- 
paratively smaller as N increases to values greater than 
10. This result shows that the DPSK protocol is a very 
practical and appealing alternative for a long-distance 
QKD system, with the potential of 1 kHz secure key gen- 
eration rate over distances longer than 200 km. 

For all the QKD protocols, if instead of the up- 
conversion detector we assume an InGaAs/InP APD 
with ^apd = 10 MHz, which is the best gate frequency 
achieved to date 0, and the typical values ??apd = 0.1 
and c^apd = 10~ 5 /gate [l7|, we find that the maximum 
communication distance is about half of the one achieved 
with an up-conversion detector, while the communication 
rate is two orders of magnitude lower than with the up- 
conversion detector, due to the gated-mode operation of 



FIG. 9: Comparison of the performance of QKD systems im- 
plementing the BB84, BBM92 and DPSK protocols. An op- 
timized up-conversion single-photon detector and Eve's ideal 
quantum memory are assumed in all cases. 

the InGaAs/InP APD. Clearly, the up-conversion detec- 
tor offers a great advantage over the InGaAs/InP APD 
as a single-photon detector in a QKD system, both in 
terms of secure communication rate and communication 
distance. 

Finally, in Fig. we compare the performance of quan- 
tum key distribution systems implementing the three 
protocols, under the assumptions that Eve is equipped 
with an ideal quantum memory and that the dark counts 
of the up-conversion detector, caused by parasitic non- 
linear processes in the PPLN waveguide, are eliminated. 
This means that the detector's performance is ideally lim- 
ited by the Si APD characteristics, which corresponds to 
d up = 5 x 10~ 8 . Operation at the maximum quantum 
efficiency regime is also assumed, i.e. r] up — 0.46. We 
observe that, ultimately, 250 km of secure communica- 
tion distance is possible with the DPSK protocol and an 
ideal single-photon source implementation of BB84, while 
BBM92 has the potential of extending this distance to 
350 km with a deterministic entangled-photon source. 



V. CONCLUSIONS 

In this paper, we studied the main characteristics of 
two types of 1.55 fim single-photon detectors, the In- 
GaAs/InP APD and the up-conversion detector, which 
combines frequency up-conversion in a PPLN waveguide 
and detection by a silicon APD. We presented the com- 
munication rate equations for the BB84 and the BBM92 
QKD protocols, and we derived a corresponding equa- 
tion for the DPSK protocol, developing a security anal- 
ysis of this protocol against certain types of hybrid at- 
tacks. Based on these equations, we compared the per- 
formance of fiber-optic quantum key distribution systems 
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employing the protocols under consideration, with re- 
alistic experimental parameters. In all cases, we found 
that a secure communication rate of two orders of mag- 
nitude higher than before is possible, while the use of the 
up-conversion detector enables quantum key distribution 
over communication distances longer by a factor of 2 than 
with an InGaAs/InP APD. Furthermore, the importance 
of the implemented protocol was illustrated, and the im- 
pact of Eve's allowed capabilities was investigated. We 
concluded that the simple and efficient DPSK protocol 
allows for more than 200 km of secure communication 
distance with high communication rates, in the realistic 
case that Eve does not possess a quantum memory with 
an infinitely long coherence time, and the time delay pa- 
rameter TV is greater than 1. The BBM92 protocol can 
extend this distance to 300 km with a reasonably high 



secure key generation rate. It is clear that improving the 
performance of the Si APDs with respect to their dead 
time and timing jitter and reducing the dark counts of 
the up-converter will extend the capabilities of fiber-optic 
QKD systems employing these protocols even further. 
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